Tencent/WeKnora · error

DNS resolution failed: no addresses for %s

Error message

DNS resolution failed: no addresses for %s

What it means

DNS guard inside Fetcher.pinnedDialContext: after the host passed SSRF/proxy checks, host resolution produced no IP addresses for the hostname. The %s names the host that failed to resolve; it fires during the SSRF-pinning dial so connections to unresolvable hosts are rejected before any TCP attempt.

Source

Thrown at internal/infrastructure/web_fetch/fetcher.go:238

	}
	return &httpFetchResult{body: body, finalURL: finalURL}, nil
}

func (f *Fetcher) pinnedDialContext() func(context.Context, string, string) (net.Conn, error) {
	return func(ctx context.Context, network, address string) (net.Conn, error) {
		host, port, err := net.SplitHostPort(address)
		if err != nil {
			return nil, fmt.Errorf("invalid address %s: %w", address, err)
		}
		if utils.IsSystemProxy(address) || utils.IsSSRFWhitelisted(host) {
			return (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext(ctx, network, address)
		}
		ips, err := f.resolveIPs(ctx, host)
		if err != nil {
			return nil, fmt.Errorf("DNS resolution failed for %s: %w", host, err)
		}
		if len(ips) == 0 {
			return nil, fmt.Errorf("DNS resolution failed: no addresses for %s", host)
		}
		for _, ip := range ips {
			if !utils.IsPublicIP(ip) {
				return nil, fmt.Errorf("connection blocked: %s resolves to restricted IP %s", host, ip)
			}
		}
		pinnedAddress := net.JoinHostPort(ips[0].String(), port)
		if f.dialContext != nil {
			return f.dialContext(ctx, network, pinnedAddress)
		}
		return (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext(ctx, network, pinnedAddress)
	}
}

func (f *Fetcher) fetchWithBrowser(ctx context.Context, rawURL string) (string, error) {
	target, err := f.resolvePinnedTarget(ctx, rawURL)
	if err != nil {
		return "", err

View on GitHub (pinned to 988cbb0330)

Solutions

1. Check the host's DNS records (it may genuinely have none, e.g. an empty A/AAAA set)
2. Verify IPv6/IPv4 availability on the host performing the fetch
3. Confirm the hostname is correct in the source URL

When it happens

Trigger: Thrown at internal/infrastructure/web_fetch/fetcher.go:238 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• DNS resolution errors: ENOTFOUND and getaddrinfo failures — how hostname lookups fail and how to debug them.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/02d21d587412cf22. Report an issue: GitHub.